CVE-2026-98171

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious or compromised remote server can exploit this flaw by sending specially crafted compound encrypted network responses. Due to improper bounds validation and pointer lifecycle management, the client can encounter a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd “smb/client: fix possible infinite loop and out-of-bounds read in symlinkdata” compares the post-ALIGN length with the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

Blackash-CVE-2025-33073

✨ CVE-2025-33073: Windows SMB RCE Vulnerability 🚨 🔥 High-Severity Authenticated Remote Code Execution 🔥 Improper Access Control in Windows SMB Client CWE-284 🛡️ Key Details at a Glance Aspect| Details ---|--- CVSS v3.1 Score| 8.8 High 🔥 Affected Systems| Windows 10, 11, Server 2012–2025 all...

windows-smb-vulnerability-framework-cve-2025-33073

Windows SMB Client Vulnerability Research Framework Author: cyberseallll Created: 2025 Overview I developed this research framework to analyze and understand CVE-2025-33073, a critical Windows SMB Client Elevation of Privilege vulnerability. This implementation provides comprehensive tools for...

cifswitch-check

cifswitch-check A shell script to check whether a Linux system is exposed to CIFSwitch CVE-2026-46243 — a local privilege escalation vulnerability in the Linux kernel's CIFS/SMB client that has been present since 2007. Runs on bare-metal hosts, VMs, and inside containers. Designed to drop straigh...

CVE-2025-33073

CVE-2025-33073 — Windows SMB Client NTLM Reflection EoP Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. An improper access control flaw in the Windows SMB Client that revives NTLM reflection techniques thought to be mitigated — letti...

CVE-2026-46243

🚨 CVE-2026-46243 - CIFSwitch Linux Kernel Local Privilege Escalation LPE Local Privilege Escalation vulnerability affecting the Linux Kernel CIFS/SMB client. 📖 Overview CVE-2026-46243 is a Local Privilege Escalation LPE vulnerability within the Linux Kernel's CIFS/SMB client. Improper validation ...

Exploit for CVE-2026-97555

CVE-2026-97555 — cifs DACL owner/group heap overflow English...

CVE-2026-99111

A flaw was found in the Linux kernel's Server Message Block SMB client. Inadequate locking during file truncation allows a local user to perform concurrent write operations while a file is being truncated. This race condition causes newly written data to be discarded silently, resulting in data...

CVE-2026-99109

A flaw was found in the Linux kernel's SMB client. This flaw allows a local, unprivileged user to cause a Denial of Service DoS or potentially escalate privileges. The CIFSSMBSetEA function fails to verify that an extended attribute value fits within the allocated request buffer before copying th...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3335)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3335 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved:...

CVE-2026-99110

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...

SUSE CVE-2026-99110

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...

DEBIAN-CVE-2026-99109

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

AZL-111200 CVE-2026-99110 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...